3 files changed, 39 insertions, 1 deletions
diff --git a/src/routes/api/profile/root.zig b/src/routes/api/profile/root.zig
index 04bf042..0bdd064 100644
--- a/src/routes/api/profile/root.zig
+++ b/src/routes/api/profile/root.zig
@@ -3,3 +3,4 @@ const HandlerInfo = memora.routes.HandlerInfo;
 
 pub const image = @import("image/root.zig");
 pub const set: HandlerInfo = .from_type(@import("set.zig"));
+pub const @"update-password": HandlerInfo = .from_type(@import("update-password.zig"));
diff --git a/src/routes/api/profile/update-password.zig b/src/routes/api/profile/update-password.zig
new file mode 100644
index 0000000..ac6ceed
--- /dev/null
+++ b/src/routes/api/profile/update-password.zig
@@ -0,0 +1,37 @@
+const std = @import("std");
+
+const memora = @import("memora");
+const Context = memora.Context;
+const Storage = memora.Storage;
+
+pub const access = .users;
+
+const Body = struct {
+    current_password: []const u8,
+    new_password: []const u8,
+};
+
+const Response = struct {
+    success: bool,
+};
+
+pub fn post(ctx: *Context, body: Body) !Response {
+    if (ctx.storage.sessions.get(ctx.storage, ctx.fingerprint)) |session| {
+        var user = try Storage.User.open(ctx.storage, session.info.name);
+        defer user.deinit();
+
+        const result = Response {
+            .success = user.check_password(body.current_password)
+        };
+
+        if (result.success) {
+            try user.set_password(body.new_password);
+            try user.sync();
+        }
+
+        return result;
+
+    } else {
+        return error.UnknownSession;
+    }
+}
diff --git a/src/storage/user.zig b/src/storage/user.zig
index 86d82ff..b817f84 100644
--- a/src/storage/user.zig
+++ b/src/storage/user.zig
@@ -125,7 +125,7 @@ pub fn new(
 }
 
 pub fn set_password(self: *Self, password: []const u8) !void {
-    const allocator = self.area.allocator();
+    const allocator = self.arena.allocator();
     const hash_buf = try allocator.alloc(u8, 256);
     const hash = try std.crypto.pwhash.bcrypt.strHash(
         password,